CVE-2018-16858: libreoffice

CVSS: 9.8v3.0CriticalModified

AliasesMGASA-2019-0102SUSE-SU-2019:1448-1SUSE-SU-2019:1894-1+7 more

Published 25-03-2019Last modified 05-08-2024

Vulnerability summary

CVE-2018-16858 is a critical (CVSS 9.8) vulnerability in libreoffice. EPSS estimates a 67.32% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

67.32%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2024:10983-1 USN-3883-1

Timeline

25-03-2019
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

67.32%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 67.32% on 19-09-2026

19-09-202619-10-2026

EPSS score

67.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaselocalmultipleVerified
LibreOffice < 6.0.7 / 6.1.3 - Macro Code Execution (Metasploit)
Maturity: weaponized
MetasploitremoteUnverified
LibreOffice Macro Code Execution
exploit/multi/fileformat/libreoffice_macro_exec
Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat162 products

autocorr-af< 1:5.3.6.1-21.el7
autocorr-bg< 1:5.3.6.1-21.el7
autocorr-ca< 1:5.3.6.1-21.el7
autocorr-cs< 1:5.3.6.1-21.el7
autocorr-da< 1:5.3.6.1-21.el7

autocorr-de< 1:5.3.6.1-21.el7
autocorr-en< 1:5.3.6.1-21.el7
autocorr-es< 1:5.3.6.1-21.el7
autocorr-fa< 1:5.3.6.1-21.el7
autocorr-fi< 1:5.3.6.1-21.el7
autocorr-fr< 1:5.3.6.1-21.el7
autocorr-ga< 1:5.3.6.1-21.el7
autocorr-hr< 1:5.3.6.1-21.el7
autocorr-hu< 1:5.3.6.1-21.el7
autocorr-is< 1:5.3.6.1-21.el7
autocorr-it< 1:5.3.6.1-21.el7
autocorr-ja< 1:5.3.6.1-21.el7
autocorr-ko< 1:5.3.6.1-21.el7
autocorr-lb< 1:5.3.6.1-21.el7
autocorr-lt< 1:5.3.6.1-21.el7
autocorr-mn< 1:5.3.6.1-21.el7
autocorr-nl< 1:5.3.6.1-21.el7
autocorr-pl< 1:5.3.6.1-21.el7
autocorr-pt< 1:5.3.6.1-21.el7
autocorr-ro< 1:5.3.6.1-21.el7
autocorr-ru< 1:5.3.6.1-21.el7
autocorr-sk< 1:5.3.6.1-21.el7
autocorr-sl< 1:5.3.6.1-21.el7
autocorr-sr< 1:5.3.6.1-21.el7
autocorr-sv< 1:5.3.6.1-21.el7
autocorr-tr< 1:5.3.6.1-21.el7
autocorr-vi< 1:5.3.6.1-21.el7
autocorr-zh< 1:5.3.6.1-21.el7
libreoffice< 1:5.3.6.1-21.el7
libreoffice-base< 1:5.3.6.1-21.el7
libreoffice-bsh< 1:5.3.6.1-21.el7
libreoffice-calc< 1:5.3.6.1-21.el7
libreoffice-core< 1:5.3.6.1-21.el7
libreoffice-data< 1:5.3.6.1-21.el7
libreoffice-debuginfo< 1:5.3.6.1-21.el7
libreoffice-draw< 1:5.3.6.1-21.el7
libreoffice-emailmerge< 1:5.3.6.1-21.el7
libreoffice-filters< 1:5.3.6.1-21.el7
libreoffice-gdb-debug-support< 1:5.3.6.1-21.el7
libreoffice-glade< 1:5.3.6.1-21.el7
libreoffice-graphicfilter< 1:5.3.6.1-21.el7
libreoffice-gtk2< 1:5.3.6.1-21.el7
libreoffice-gtk3< 1:5.3.6.1-21.el7
libreoffice-help-ar< 1:5.3.6.1-21.el7
libreoffice-help-bg< 1:5.3.6.1-21.el7
libreoffice-help-bn< 1:5.3.6.1-21.el7
libreoffice-help-ca< 1:5.3.6.1-21.el7
libreoffice-help-cs< 1:5.3.6.1-21.el7
libreoffice-help-da< 1:5.3.6.1-21.el7
libreoffice-help-de< 1:5.3.6.1-21.el7
libreoffice-help-dz< 1:5.3.6.1-21.el7
libreoffice-help-el< 1:5.3.6.1-21.el7
libreoffice-help-es< 1:5.3.6.1-21.el7
libreoffice-help-et< 1:5.3.6.1-21.el7
libreoffice-help-eu< 1:5.3.6.1-21.el7
libreoffice-help-fi< 1:5.3.6.1-21.el7
libreoffice-help-fr< 1:5.3.6.1-21.el7
libreoffice-help-gl< 1:5.3.6.1-21.el7
libreoffice-help-gu< 1:5.3.6.1-21.el7
libreoffice-help-he< 1:5.3.6.1-21.el7
libreoffice-help-hi< 1:5.3.6.1-21.el7
libreoffice-help-hr< 1:5.3.6.1-21.el7
libreoffice-help-hu< 1:5.3.6.1-21.el7
libreoffice-help-id< 1:5.3.6.1-21.el7
libreoffice-help-it< 1:5.3.6.1-21.el7
libreoffice-help-ja< 1:5.3.6.1-21.el7
libreoffice-help-ko< 1:5.3.6.1-21.el7
libreoffice-help-lt< 1:5.3.6.1-21.el7
libreoffice-help-lv< 1:5.3.6.1-21.el7
libreoffice-help-nb< 1:5.3.6.1-21.el7
libreoffice-help-nl< 1:5.3.6.1-21.el7
libreoffice-help-nn< 1:5.3.6.1-21.el7
libreoffice-help-pl< 1:5.3.6.1-21.el7
libreoffice-help-pt-BR< 1:5.3.6.1-21.el7
libreoffice-help-pt-PT< 1:5.3.6.1-21.el7
libreoffice-help-ro< 1:5.3.6.1-21.el7
libreoffice-help-ru< 1:5.3.6.1-21.el7
libreoffice-help-si< 1:5.3.6.1-21.el7
libreoffice-help-sk< 1:5.3.6.1-21.el7
libreoffice-help-sl< 1:5.3.6.1-21.el7
libreoffice-help-sv< 1:5.3.6.1-21.el7
libreoffice-help-ta< 1:5.3.6.1-21.el7
libreoffice-help-tr< 1:5.3.6.1-21.el7
libreoffice-help-uk< 1:5.3.6.1-21.el7
libreoffice-help-zh-Hans< 1:5.3.6.1-21.el7
libreoffice-help-zh-Hant< 1:5.3.6.1-21.el7
libreoffice-impress< 1:5.3.6.1-21.el7
libreoffice-langpack-af< 1:5.3.6.1-21.el7
libreoffice-langpack-ar< 1:5.3.6.1-21.el7
libreoffice-langpack-as< 1:5.3.6.1-21.el7
libreoffice-langpack-bg< 1:5.3.6.1-21.el7
libreoffice-langpack-bn< 1:5.3.6.1-21.el7
libreoffice-langpack-br< 1:5.3.6.1-21.el7
libreoffice-langpack-ca< 1:5.3.6.1-21.el7
libreoffice-langpack-cs< 1:5.3.6.1-21.el7
libreoffice-langpack-cy< 1:5.3.6.1-21.el7
libreoffice-langpack-da< 1:5.3.6.1-21.el7
libreoffice-langpack-de< 1:5.3.6.1-21.el7
libreoffice-langpack-dz< 1:5.3.6.1-21.el7
libreoffice-langpack-el< 1:5.3.6.1-21.el7
libreoffice-langpack-en< 1:5.3.6.1-21.el7
libreoffice-langpack-es< 1:5.3.6.1-21.el7
libreoffice-langpack-et< 1:5.3.6.1-21.el7
libreoffice-langpack-eu< 1:5.3.6.1-21.el7
libreoffice-langpack-fa< 1:5.3.6.1-21.el7
libreoffice-langpack-fi< 1:5.3.6.1-21.el7
libreoffice-langpack-fr< 1:5.3.6.1-21.el7
libreoffice-langpack-ga< 1:5.3.6.1-21.el7
libreoffice-langpack-gl< 1:5.3.6.1-21.el7
libreoffice-langpack-gu< 1:5.3.6.1-21.el7
libreoffice-langpack-he< 1:5.3.6.1-21.el7
libreoffice-langpack-hi< 1:5.3.6.1-21.el7
libreoffice-langpack-hr< 1:5.3.6.1-21.el7
libreoffice-langpack-hu< 1:5.3.6.1-21.el7
libreoffice-langpack-id< 1:5.3.6.1-21.el7
libreoffice-langpack-it< 1:5.3.6.1-21.el7
libreoffice-langpack-ja< 1:5.3.6.1-21.el7
libreoffice-langpack-kk< 1:5.3.6.1-21.el7
libreoffice-langpack-kn< 1:5.3.6.1-21.el7
libreoffice-langpack-ko< 1:5.3.6.1-21.el7
libreoffice-langpack-lt< 1:5.3.6.1-21.el7
libreoffice-langpack-lv< 1:5.3.6.1-21.el7
libreoffice-langpack-mai< 1:5.3.6.1-21.el7
libreoffice-langpack-ml< 1:5.3.6.1-21.el7
libreoffice-langpack-mr< 1:5.3.6.1-21.el7
libreoffice-langpack-nb< 1:5.3.6.1-21.el7
libreoffice-langpack-nl< 1:5.3.6.1-21.el7
libreoffice-langpack-nn< 1:5.3.6.1-21.el7
libreoffice-langpack-nr< 1:5.3.6.1-21.el7
libreoffice-langpack-nso< 1:5.3.6.1-21.el7
libreoffice-langpack-or< 1:5.3.6.1-21.el7
libreoffice-langpack-pa< 1:5.3.6.1-21.el7
libreoffice-langpack-pl< 1:5.3.6.1-21.el7
libreoffice-langpack-pt-BR< 1:5.3.6.1-21.el7
libreoffice-langpack-pt-PT< 1:5.3.6.1-21.el7
libreoffice-langpack-ro< 1:5.3.6.1-21.el7
libreoffice-langpack-ru< 1:5.3.6.1-21.el7
libreoffice-langpack-si< 1:5.3.6.1-21.el7
libreoffice-langpack-sk< 1:5.3.6.1-21.el7
libreoffice-langpack-sl< 1:5.3.6.1-21.el7
libreoffice-langpack-sr< 1:5.3.6.1-21.el7
libreoffice-langpack-ss< 1:5.3.6.1-21.el7
libreoffice-langpack-st< 1:5.3.6.1-21.el7
libreoffice-langpack-sv< 1:5.3.6.1-21.el7
libreoffice-langpack-ta< 1:5.3.6.1-21.el7
libreoffice-langpack-te< 1:5.3.6.1-21.el7
libreoffice-langpack-th< 1:5.3.6.1-21.el7
libreoffice-langpack-tn< 1:5.3.6.1-21.el7
libreoffice-langpack-tr< 1:5.3.6.1-21.el7
libreoffice-langpack-ts< 1:5.3.6.1-21.el7
libreoffice-langpack-uk< 1:5.3.6.1-21.el7
libreoffice-langpack-ve< 1:5.3.6.1-21.el7
libreoffice-langpack-xh< 1:5.3.6.1-21.el7
libreoffice-langpack-zh-Hans< 1:5.3.6.1-21.el7
libreoffice-langpack-zh-Hant< 1:5.3.6.1-21.el7
libreoffice-langpack-zu< 1:5.3.6.1-21.el7
libreoffice-librelogo< 1:5.3.6.1-21.el7

Show all 162

Mageia23 products

cppunit< 1.14.0-1.mga6
libabw< 0.1.2-1.mga6
libcdr< 0.1.5-1.mga6
libcmis< 0.5.2-1.mga6
libe-book< 0.1.3-1.mga6

Show all 23

Opensuse12 products

libixion&distro=openSUSE Leap 15.0< 0.14.1-lp151.4.3.1
libixion&distro=openSUSE Leap 15.1< 0.14.1-lp151.4.3.1
liborcus&distro=openSUSE Leap 15.0< 0.14.1-lp151.3.3.1
liborcus&distro=openSUSE Leap 15.1< 0.14.1-lp151.3.3.1
libreoffice&distro=openSUSE Leap 15.0< 6.2.5.2-lp151.3.3.4

Show all 12

Debian1 product

libreoffice< 1:6.1.3-1 | < 1:5.2.7-1+deb9u5 | < 1:4.3.3-2+deb8u12

Libreoffice1 product

libreoffice< 6.0.7 | ≥ 6.1.0, < 6.1.3

Ubuntu1 product

libreoffice< 1:4.2.8-0ubuntu5.5 | < 1:5.1.6~rc2-0ubuntu1~xenial6

6 vendors · 200 products · Showing 200 of 261. Use Open JSON for the complete list.

References

48 links

www.libreoffice.org/about-us/security/advisories/cve-2018-16858/X Refsource MISCVendor AdvisoryAdvisoryARTICLEREPORT
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16858X Refsource CONFIRMIssue TrackingThird Party Advisory
packetstormsecurity.com/files/152560/LibreOffice-Macro-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.rapid7.com/db/modules/exploit/multi/fileformat/libreoffice_macro_execX Refsource MISCThird Party Advisory
www.exploit-db.com/exploits/46727/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:2130Vendor AdvisoryX Refsource REDHATAdvisory
seclists.org/bugtraq/2019/Aug/28Mailing ListX Refsource BUGTRAQ
lists.opensuse.org/opensuse-security-announce/2019-08/msg00059.htmlVendor AdvisoryX Refsource SUSE
advisories.mageia.org/MGASA-2019-0102.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=24309REPORT

Show all 48 references

www.debian.org/security/2019/dsa-4381WEB
www.suse.com/support/update/announcement/2019/suse-su-20191448-1/Advisory
bugzilla.suse.com/1089811REPORT
bugzilla.suse.com/1116451REPORT
bugzilla.suse.com/1121874REPORT
bugzilla.suse.com/1123131REPORT
bugzilla.suse.com/1123455REPORT
bugzilla.suse.com/1124062REPORT
bugzilla.suse.com/1124869REPORT
bugzilla.suse.com/1127760REPORT
bugzilla.suse.com/1127857REPORT
bugzilla.suse.com/1128845REPORT
bugzilla.suse.com/1135189REPORT
bugzilla.suse.com/1135228REPORT
www.suse.com/security/cve/CVE-2018-16858WEB
www.suse.com/support/update/announcement/2019/suse-su-20191894-1/Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192003-1/Advisory
bugzilla.suse.com/1110348REPORT
bugzilla.suse.com/1112112REPORT
bugzilla.suse.com/1112113REPORT
bugzilla.suse.com/1112114REPORT
bugzilla.suse.com/1117195REPORT
bugzilla.suse.com/1117300REPORT
bugzilla.suse.com/1124658REPORT
bugzilla.suse.com/882383REPORT
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1066844REPORT
bugzilla.redhat.com/show_bug.cgi?id=1649841REPORT
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2130.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-16858REPORT
www.cve.org/CVERecord?id=CVE-2018-16858AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-16858Advisory
ubuntu.com/security/CVE-2018-16858REPORT
insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.htmlREPORT
ubuntu.com/security/notices/USN-3883-1Advisory
security-tracker.debian.org/tracker/CVE-2018-16858Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities